【安全更新】Oracle全系产品2023年7月关键补丁更新通告

2023年7月19日17:46:50评论84 views字数 18967阅读63分13秒阅读模式

通告编号:NS-2023-0033

2023-07-19

TAG：	Oracle、关键补丁更新、Weblogic
漏洞危害：	此次补丁更新修复了508个不同程度的漏洞，涉及多个常用产品。
版本：	1.0

漏洞概述

2023年7月19日，绿盟科技CERT监测发现Oracle官方发布了7月重要补丁更新公告CPU（Critical Patch Update），此次共修复了508个不同程度的漏洞，此次安全更新涉及Oracle WebLogic Server、Oracle MySQL、Oracle Financial Services Applications、Oracle Enterprise Manager、Oracle Retail Applications等多个常用产品。Oracle强烈建议客户尽快应用关键补丁更新修复程序，对漏洞进行修复。

参考链接：

https://www.oracle.com/security-alerts/cpujul2023.html

SEE MORE →

2重点漏洞简述

根据产品流行度和漏洞重要性筛选出此次更新中包含影响较大的漏洞，请相关用户重点进行关注：

Oracle WebLogic Server远程代码执行漏洞（CVE-2023-26119）：

Oracle WebLogic Server存在远程代码执行漏洞，未经身份验证的远程攻击者利用该漏洞，最终导致在目标服务器上执行任意代码。CVSS评分为9.8。

Oracle WebLogic Server安全特性绕过漏洞（CVE-2023-22040）：

Oracle WebLogic Server中存在安全特性绕过漏洞，具有高权限的远程攻击者可通过多种协议来破坏Oracle WebLogic服务器，成功利用此漏洞后可导致未经授权创建、删除或修改关键数据，或是访问Oracle WebLogic Server所有数据，同时也可能造成拒绝服务。

Oracle MySQL多个漏洞：

此次安全更新针对Oracle MySQL发布了24个安全补丁, 其中11个漏洞在未经用户身份验证的情况下远程进行利用，即无需用户凭据即可通过网络利用。高危漏洞编号如下：

CVE-2023-20862

CVE-2022-37865

Oracle Financial Services Applications多个漏洞：

此次安全更新针对Oracle Financial Services Applications发布了147个安全补丁。其中的115个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下：

CVE-2022-1471

CVE-2022-46364

CVE-2022-45047

CVE-2022-31692

Oracle Insurance Applications多个漏洞：

此次安全更新针对Oracle Insurance Applications发布了3个安全补丁。其中有2个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下：

CVE-2023-1436

Oracle Communications多个漏洞：

此次安全更新针对Oracle Communications发布了77个安全补丁，其中的57个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下：

CVE-2023-20862

CVE-2022-37434

CVE-2022-1471

CVE-2023-20873

CVE-2022-36944

Oracle Communications Applications多个漏洞：

此次安全更新针对Oracle Communications Applications发布了40个安全补丁。其中的30个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞如下：

CVE-2022-1471

CVE-2021-42575

CVE-2022-46364

CVE-2022-31692

CVE-2023-20873

CVE-2023-20862

CVE-2020-35169

Oracle Enterprise Manager多个漏洞：

此次安全更新针对Oracle Enterprise Manager发布了8个安全补丁。其中有6个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下：

CVE-2022-23305

CVE-2023-25690

Oracle Retail Applications多个漏洞：

此次安全更新针对Oracle Retail Applications发布了11个安全补丁。其中有8个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下：

CVE-2022-37434

Oracle Siebel CRM多个漏洞：

此次安全更新针对Oracle Siebel CRM发布了9个安全补丁。其中有9个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下：

CVE-2022-1471

Oracle Supply Chain多个漏洞：

此次安全更新针对Oracle Supply Chain发布了13个安全补丁。其中有11个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下：

CVE-2022-37434

CVE-2022-27404

Oracle官方7月关键补丁更新漏洞总结如下：

产品	漏洞个数	未授权远程利用的个数	最高CVSS评分
Oracle Database Products Risk Matrices	5	1	6.5
Oracle Database Server	5	1	6.5
Oracle Application Express	3	1	9
Oracle Big Data Spatial and Graph	2	0	6
Oracle Essbase	2	0	6
Oracle GoldenGate	2	1	6.5
Oracle Graph Server and Client	1	1	7.5
Oracle NoSQL Database	1	0	4.3
Oracle Secure Backup	1	0	4.3
Oracle Spatial Studio	1	0	4.3
Oracle TimesTen In-Memory Database	1	1	8.1
Oracle Commerce	8	8	7.5
Oracle Communications Applications	40	30	9.8
Oracle Communications	77	57	9.8
Oracle Construction and Engineering	6	5	7.5
Oracle E-Business Suite	5	3	6.5
Oracle Enterprise Manager	8	6	9.8
Oracle Financial Services Applications	147	115	9.8
Oracle Food and Beverage Applications	1	1	9.8
Oracle Fusion Middleware	60	40	9.8
Oracle Analytics	32	23	9.8
Oracle Health Sciences Applications	1	0	6.5
Oracle Hospitality Applications	2	2	9.8
Oracle Hyperion	3	1	9.8
Oracle Insurance Applications	3	2	7.5
Oracle Java SE	9	8	5.9
Oracle JD Edwards	4	3	9.8
Oracle MySQL	24	11	9.8
Oracle PeopleSoft	9	8	9.8
Oracle Policy Automation	2	2	7.5
Oracle Retail Applications	11	8	9.8
Oracle Siebel CRM	9	9	9.8
Oracle Supply Chain	13	11	9.8
Oracle Systems	1	0	7.8
Oracle Utilities Applications	14	12	9.8
Oracle Virtualization	4	2	8.1

3漏洞防护

3.1 补丁更新

请用户参考本文附录“受影响产品及补丁信息”及时下载受影响产品更新补丁，并参照补丁安装包中的readme文件进行安装更新，以保证长期有效的防护。

注：Oracle官方补丁需要用户持有正版软件的许可账号，使用该账号登陆https://support.oracle.com后，可以下载最新补丁。

3.2 Weblogic临时防护措施

若相关用户暂时无法安装补丁或不通过T3协议进行JVM通信，可使用下列措施阻断针对利用T3协议漏洞的攻击：

WebLogic Server提供了名为 weblogic.security.net.ConnectionFilterImpl 的默认连接筛选器，此连接筛选器接受所有传入连接，可通过此连接筛选器配置规则，对T3及T3s协议进行访问控制，详细操作步骤如下：

1. 进入WebLogic控制台，在base_domain的配置页面中，进入“安全”选项卡页面，点击“筛选器”，进入连接筛选器配置。

【安全更新】Oracle全系产品2023年7月关键补丁更新通告

2. 在连接筛选器中输入：weblogic.security.net.ConnectionFilterImpl，参考以下写法，在连接筛选器规则中配置符合企业实际情况的规则：

127.0.0.1 * * allow t3 t3s

本机IP ** allow t3 t3s

允许访问的IP * * allow t3 t3s

* * * deny t3 t3s

【安全更新】Oracle全系产品2023年7月关键补丁更新通告

连接筛选器规则格式如下：target localAddress localPort action protocols，其中：

target 指定一个或多个要筛选的服务器。

localAddress 可定义服务器的主机地址。(如果指定为一个星号 (*)，则返回的匹配结果将是所有本地 IP 地址。)

localPort 定义服务器正在监听的端口。(如果指定了星号，则匹配返回的结果将是服务器上所有可用的端口)。

action 指定要执行的操作。(值必须为“allow”或“deny”。)

protocols 是要进行匹配的协议名列表。(必须指定下列其中一个协议：http、https、t3、t3s、giop、giops、dcom 或 ftp。) 如果未定义协议，则所有协议都将与一个规则匹配。

3. 保存后若规则未生效，建议重新启动WebLogic服务（重启WebLogic服务会导致业务中断，建议相关人员评估风险后，再进行操作）。以Windows环境为例，重启服务的步骤如下：

进入域所在目录下的bin目录，在Windows系统中运行stopWebLogic.cmd文件终止WebLogic服务，Linux系统中则运行stopWebLogic.sh文件。

【安全更新】Oracle全系产品2023年7月关键补丁更新通告

待终止脚本执行完成后，再运行startWebLogic.cmd或startWebLogic.sh文件启动WebLogic，即可完成WebLogic服务重启。

参考链接：

https://docs.oracle.com/cd/E24329_01/web.1211/e24485/con_filtr.htm#SCPRG377

附录受影响产品及补丁信息

受影响产品及版本号	可用补丁
Application Management Pack for Oracle Utilities & Enterprise Taxation, versions 13.4.1.0.0, 13.5.1.0.0	https://support.oracle.com/rs?type=doc&id=2957770.1
BI Publisher, versions 6.4.0.0.0, 7.0.0.0.0	https://support.oracle.com/rs?type=doc&id=2958379.2
JD Edwards EnterpriseOne Orchestrator, versions prior to 9.2.7.4	https://support.oracle.com/rs?type=doc&id=2959208.1
JD Edwards EnterpriseOne Tools, versions prior to 9.2.7.4	https://support.oracle.com/rs?type=doc&id=2959208.1
MySQL Cluster, versions 8.0.33 and prior	https://support.oracle.com/rs?type=doc&id=2958912.1
MySQL Connectors, versions 8.0.33 and prior	https://support.oracle.com/rs?type=doc&id=2958912.1
MySQL Enterprise Monitor, versions 8.0.34 and prior	https://support.oracle.com/rs?type=doc&id=2958912.1
MySQL Server, versions 5.7.42 and prior, 8.0.33 and prior	https://support.oracle.com/rs?type=doc&id=2958912.1
MySQL Workbench, versions 8.0.33 and prior	https://support.oracle.com/rs?type=doc&id=2958912.1
Oracle Access Manager, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Agile Engineering Data Management, versions 6.2.1.0-6.2.1.8	https://support.oracle.com/rs?type=doc&id=2959239.1
Oracle Agile PLM, version 9.3.6	https://support.oracle.com/rs?type=doc&id=2959239.1
Oracle Application Express, versions [Application Express Administration] 18.2-22.2, [Application Express Customers Plugin] 18.2-22.2, [Application Express Team Calendar Plugin] 18.2-22.1	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle Application Testing Suite, version 13.3.0.1	https://support.oracle.com/rs?type=doc&id=2946187.1
Oracle AutoVue, versions 21.0.2.0-21.0.2.7	https://support.oracle.com/rs?type=doc&id=2959239.1
Oracle Autovue for Agile Product Lifecycle Management, version 21.0.2	https://support.oracle.com/rs?type=doc&id=2959239.1
Oracle BAM (Business Activity Monitoring), version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Banking APIs, versions 18.2.0.0.0, 18.3.0.0.0, 19.1.0.0.0, 19.2.0.0.0, 21.1.0.0.0, 22.1.0.0.0, 22.2.0.0.0	https://support.oracle.com
Oracle Banking Branch, versions 14.5-14.7	https://support.oracle.com
Oracle Banking Cash Management, versions 14.7.0.2.0, 14.7.1.0.0	https://support.oracle.com
Oracle Banking Corporate Lending, versions 14.0-14.3, 14.5-14.7	https://support.oracle.com
Oracle Banking Corporate Lending Process Management, versions 14.4-14.7	https://support.oracle.com
Oracle Banking Credit Facilities Process Management, version 14.7.1.0.0	https://support.oracle.com
Oracle Banking Digital Experience, versions 18.2.0.0.0, 18.3.0.0.0, 19.1.0.0.0, 19.2.0.0.0, 21.1.0.0.0, 22.1.0.0.0, 22.2.0.0.0	https://support.oracle.com
Oracle Banking Liquidity Management, versions 14.5.0.8.0, 14.6.0.3.0, 14.6.0.4.0, 14.7.0.1.0, 14.7.0.2.0, 14.7.1.0.0	https://support.oracle.com
Oracle Banking Origination, versions 14.5-14.7, 14.7.0	https://support.oracle.com
Oracle Banking Payments, versions 14.5-14.7	https://support.oracle.com
Oracle Banking Supply Chain Finance, versions 14.7.0.2.0, 14.7.1.0.0	https://support.oracle.com
Oracle Banking Trade Finance, versions 14.0-14.3, 14.5-14.7	https://support.oracle.com
Oracle Banking Trade Finance Process Management, versions 14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0	https://support.oracle.com
Oracle Banking Treasury Management, versions 14.5-14.7	https://support.oracle.com
Oracle Big Data Spatial and Graph, version 3.0	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle Business Intelligence Enterprise Edition, versions 6.4.0.0.0, 7.0.0.0.0, 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958379.2
Oracle Business Process Management Suite, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Coherence, versions 12.2.1.4.0, 14.1.1.0.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Commerce Guided Search, version 11.3.2	https://support.oracle.com/rs?type=doc&id=2959205.1
Oracle Commerce Platform, versions 11.3.0, 11.3.1, 11.3.2	https://support.oracle.com/rs?type=doc&id=2959205.1
Oracle Communications Billing and Revenue Management, versions 12.0.0.4.0-12.0.0.8.0	https://support.oracle.com/rs?type=doc&id=2957693.1
Oracle Communications BRM - Elastic Charging Engine, versions 12.0.0.4.0-12.0.0.8.0	https://support.oracle.com/rs?type=doc&id=2957693.1
Oracle Communications Calendar Server, versions 8.0.0.2.0-8.0.0.7.0	https://support.oracle.com/rs?type=doc&id=2957711.1
Oracle Communications Cloud Native Core Automated Test Suite, versions 22.4.1, 23.1.0, 23.1.1	https://support.oracle.com/rs?type=doc&id=2960528.1
Oracle Communications Cloud Native Core Binding Support Function, versions 22.4.0, 23.1.0	https://support.oracle.com/rs?type=doc&id=2960529.1
Oracle Communications Cloud Native Core Console, versions 22.4.2, 23.1.1	https://support.oracle.com/rs?type=doc&id=2960530.1
Oracle Communications Cloud Native Core Network Exposure Function, versions 22.4.3, 23.1.2	https://support.oracle.com/rs?type=doc&id=2960531.1
Oracle Communications Cloud Native Core Network Function Cloud Native Environment, version 23.1.0	https://support.oracle.com/rs?type=doc&id=2960532.1
Oracle Communications Cloud Native Core Network Repository Function, versions 22.4.2, 22.4.3, 23.1.0, 23.1.1, 23.2.0	https://support.oracle.com/rs?type=doc&id= 2960533.1
Oracle Communications Cloud Native Core Policy, versions 22.4.0, 23.1.0, 23.2.0	https://support.oracle.com/rs?type=doc&id=2960534.1
Oracle Communications Cloud Native Core Security Edge Protection Proxy, versions 22.3.2, 22.4.0, 22.4.3, 23.1.0, 23.1.1, 23.1.2	https://support.oracle.com/rs?type=doc&id=2960535.1
Oracle Communications Cloud Native Core Service Communication Proxy, versions 22.4.0, 23.1.0	https://support.oracle.com/rs?type=doc&id=2960537.1
Oracle Communications Cloud Native Core Unified Data Repository, version 23.1.1	https://support.oracle.com/rs?type=doc&id=2960549.1
Oracle Communications Contacts Server, versions 8.0.0.6.0-8.0.0.8.0	https://support.oracle.com/rs?type=doc&id=2957711.1
Oracle Communications Converged Application Server - Service Controller, version 6.2.0	https://support.oracle.com/rs?type=doc&id=2960550.1
Oracle Communications Convergence, version 3.0.3.2	https://support.oracle.com/rs?type=doc&id=2957711.1
Oracle Communications Convergent Charging Controller, versions 12.0.3.0.0-12.0.6.0.0	https://support.oracle.com/rs?type=doc&id=2957695.1
Oracle Communications Design Studio, versions 7.4.0.7.0, 7.4.1.5.0, 7.4.2.8.0	https://support.oracle.com/rs?type=doc&id=2961899.1
Oracle Communications Diameter Signaling Router, version 8.6.0.0	https://support.oracle.com/rs?type=doc&id=2960570.1
Oracle Communications Instant Messaging Server, version 10.0.1.7.0	https://support.oracle.com/rs?type=doc&id=2957711.1
Oracle Communications Messaging Server, version 8.1.0.21.0	https://support.oracle.com/rs?type=doc&id=2957711.1
Oracle Communications Network Analytics Data Director, version 23.1.0	https://support.oracle.com/rs?type=doc&id=2961143.1
Oracle Communications Network Charging and Control, versions 12.0.3.0.0-12.0.6.0.0	https://support.oracle.com/rs?type=doc&id=2957695.1
Oracle Communications Network Integrity, version 7.3.6.4	https://support.oracle.com/rs?type=doc&id=2959869.1
Oracle Communications Operations Monitor, versions 5.0, 5.1	https://support.oracle.com/rs?type=doc&id=2960571.1
Oracle Communications Order and Service Management, versions 7.3.5, 7.4.0, 7.4.1	https://support.oracle.com/rs?type=doc&id=2957694.1
Oracle Communications Pricing Design Center, versions 12.0.0.4.0-12.0.0.7.0	https://support.oracle.com/rs?type=doc&id=2957693.1
Oracle Communications Unified Assurance, versions 5.5.0-5.5.17, 6.0.0-6.0.2	https://support.oracle.com/rs?type=doc&id=2957696.1
Oracle Communications Unified Inventory Management, versions 7.4.0-7.4.2, 7.5.0	https://support.oracle.com/rs?type=doc&id=2959836.1
Oracle Data Integrator, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Database Server, versions 19.3-19.19, 21.3-21.10	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle Documaker, versions 12.6.1-12.7.1	https://support.oracle.com/rs?type=doc&id=2960012.1
Oracle E-Business Suite, versions 12.2.3-12.3.12	https://support.oracle.com/rs?type=doc&id=2484000.1
Oracle Enterprise Data Quality, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Enterprise Manager for Exadata, version 13.5.0.0	https://support.oracle.com/rs?type=doc&id=2946187.1
Oracle Enterprise Manager for Fusion Middleware, version 13.5.0.0	https://support.oracle.com/rs?type=doc&id=2946187.1
Oracle Enterprise Manager for Oracle Database, version 13.5.0.0	https://support.oracle.com/rs?type=doc&id=2946187.1
Oracle Enterprise Manager Ops Center, version 12.4.0.0	https://support.oracle.com/rs?type=doc&id=2946187.1
Oracle Enterprise Operations Monitor, versions 5.0, 5.1	https://support.oracle.com/rs?type=doc&id=2960572.1
Oracle Essbase, version 21.4.3.0.0	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.7, 8.0.8, 8.1.0, 8.1.1, 8.1.2	https://support.oracle.com/rs?type=doc&id=2960444.1
Oracle Financial Services Behavior Detection Platform, versions 8.0.8.1, 8.1.1.1, 8.1.2.4, 8.1.2.5	https://support.oracle.com/rs?type=doc&id=2959412.1
Oracle Financial Services Compliance Studio, version 8.1.2.4	https://support.oracle.com/rs?type=doc&id=2959360.1
Oracle Financial Services Enterprise Case Management, versions 8.0.8.2, 8.1.1.1, 8.1.2.4, 8.1.2.5	https://support.oracle.com/rs?type=doc&id=2959391.1
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition, version 8.0.8	https://support.oracle.com/rs?type=doc&id=2959413.1
Oracle FLEXCUBE Investor Servicing, version 14.7.0.0.0	https://support.oracle.com
Oracle FLEXCUBE Universal Banking, versions 14.0-14.7	https://support.oracle.com
Oracle Fusion Middleware MapViewer, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle GoldenGate, versions 19.1.0.0.0-19.1.0.0.230422, 21.3.0.0.0-21.10.0.0.5	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle GoldenGate Stream Analytics, versions 19.1.0.0.0-19.1.0.0.7	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle GraalVM Enterprise Edition, versions 20.3.10, 21.3.6, 22.3.2	https://support.oracle.com/rs?type=doc&id=2957260.1
Oracle GraalVM for JDK, versions 17.0.7, 20.0.1	https://support.oracle.com/rs?type=doc&id=2957260.1
Oracle Graph Server and Client, versions 21.4.6, 21.4.7, 22.4.1, 22.4.2, 23.1.0	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle Health Sciences Sciences Data Management Workbench, versions 3.1.0.2, 3.1.1.3, 3.2.0.0	https://support.oracle.com/rs?type=doc&id=2959737.1
Oracle Hospitality Cruise Shipboard Property Management System, versions 20.1.0, 20.2.0, 20.3.3	https://support.oracle.com/rs?type=doc&id=2956382.1
Oracle Hospitality Simphony, version 19.5	https://support.oracle.com/rs?type=doc&id=2953046.1
Oracle HTTP Server, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Hyperion Data Relationship Management, version 11.2.13.0.0	https://support.oracle.com/rs?type=doc&id=2775466.2
Oracle Hyperion Essbase Administration Services, version 21.4.3.0.0	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle Hyperion Financial Reporting, version 11.2.13.0.0	https://support.oracle.com/rs?type=doc&id=2775466.2
Oracle Hyperion Workspace, version 11.2.13.0.0	https://support.oracle.com/rs?type=doc&id=2775466.2
Oracle Identity Manager, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Identity Manager Connector, versions 9.1.0, 12.2.1.3.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Java SE, versions 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1	https://support.oracle.com/rs?type=doc&id=2957260.1
Oracle JDeveloper, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Middleware Common Libraries and Tools, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Mobile Security Suite, versions prior to 11.1.2.3.1	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle NoSQL Database, versions 19.5.33, 20.3.28, 21.2.55, 22.3.26	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle Policy Automation, versions prior to 12.2.31	https://support.oracle.com/rs?type=doc&id=2957599.1
Oracle Retail Advanced Inventory Planning, versions 15.0, 16.0	https://support.oracle.com/rs?type=doc&id=2956573.1
Oracle Retail Bulk Data Integration, versions 16.0.3, 19.0.1	https://support.oracle.com/rs?type=doc&id=2956573.1
Oracle Retail Financial Integration, versions 14.2.0, 15.0.4, 16.0.3, 19.0.1	https://support.oracle.com/rs?type=doc&id=2956573.1
Oracle Retail Integration Bus, versions 14.2.0, 15.0.4, 16.0.3, 19.0.1	https://support.oracle.com/rs?type=doc&id=2956573.1
Oracle Retail Order Broker, version 19.1	https://support.oracle.com/rs?type=doc&id=2956573.1
Oracle Retail Predictive Application Server, versions 15.0.3, 16.0.3	https://support.oracle.com/rs?type=doc&id=2956573.1
Oracle Retail Service Backbone, versions 14.2.0, 15.0.4, 16.0.3, 19.0.1	https://support.oracle.com/rs?type=doc&id=2956573.1
Oracle SD-WAN Edge, version 9.1.1.5.0	https://support.oracle.com/rs?type=doc&id=2960573.1
Oracle Secure Backup, version 18.1.0.1.0	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle Service Bus, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle SOA Suite, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle Solaris, version 11	https://support.oracle.com/rs?type=doc&id=2960446.1
Oracle Spatial Studio, version 22.3.0	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle TimesTen In-Memory Database, versions 22.1.1.1.0-22.1.1.11.0	https://support.oracle.com/rs?type=doc&id=2946185.1
Oracle Utilities Application Framework, versions 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.0, 4.5.0.1.1	https://support.oracle.com/rs?type=doc&id=2957770.1
Oracle Utilities Network Management System, versions 2.4.0.1.21, 2.5.0.0.9, 2.5.0.1, 2.5.0.1.11, 2.5.0.2, 2.5.0.2.3, 2.6.0.0	https://support.oracle.com/rs?type=doc&id=2957770.1
Oracle Utilities Testing Accelerator, versions 6.0.0.1-7.0.0.0	https://support.oracle.com/rs?type=doc&id=2957770.1
Oracle VM VirtualBox, versions prior to 6.1.46, prior to 7.0.10	https://support.oracle.com/rs?type=doc&id=2960866.1
Oracle WebCenter Content, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle WebCenter Sites, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2958367.2
Oracle WebLogic Server, versions 12.2.1.4.0, 14.1.1.0.0	https://support.oracle.com/rs?type=doc&id=2958367.2
PeopleSoft Enterprise PeopleTools, versions 8.59, 8.60	https://support.oracle.com/rs?type=doc&id=2959206.1
Primavera Gateway, versions 18.8.0-18.8.15, 19.12.0-19.12.16, 20.12.0-20.12.11, 21.12.0-21.12.9	https://support.oracle.com/rs?type=doc&id=2958838.1
Primavera P6 Enterprise Project Portfolio Management, versions 22.12.2, 22.12.3	https://support.oracle.com/rs?type=doc&id=2958838.1
Primavera Unifier, versions 18.8.0-18.8.18, 19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.15, 22.12.0-22.12.6	https://support.oracle.com/rs?type=doc&id=2958838.1
Siebel Applications, versions 22.12 and prior, 23.6 and prior	https://support.oracle.com/rs?type=doc&id=2959207.1

END

声明

本安全公告仅用来描述可能存在的安全问题，绿盟科技不为此安全公告提供任何保证或承诺。由于传播、利用此安全公告所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，绿盟科技以及安全公告作者不为此承担任何责任。

【安全更新】Oracle全系产品2023年7月关键补丁更新通告

原文始发于微信公众号（绿盟科技CERT）：【安全更新】Oracle全系产品2023年7月关键补丁更新通告

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。

左青龙
微信扫一扫

右白虎
微信扫一扫

【安全更新】Oracle全系产品2023年7月关键补丁更新通告

漏洞复现 || XWiki Platform系统远程代码执行 POC

用友NC files 反序列化RCE

【高危漏洞预警】Elastic Kibana需授权代码注入漏洞 (CVE-2025-25014)

CVE-2025-2905（CVSS 9.1）：WSO2 API 管理器中发现严重 XXE 漏洞

【风险通告】Elastic Kibana存在原型污染致任意代码执行漏洞（CVE-2025-25014）

Kibana 原型污染导致执行任意代码漏洞（CVE-2025-25014）

CVE-2025-24071：通过 RAR/ZIP 提取和 .library-ms 文件泄露 NTLM 哈希值

Kibana 原型污染导致执行任意代码漏洞（CVE-2025-25014）

WordPress depicter插件SQL注入漏洞（CVE-2025-2011）

Kibana 原型污染导致任意代码执行漏洞 (CVE-2025-25014)

发表评论

在线咨询

微信